I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: Zero Trust Planning

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

Zero Trust Planning

Zero Trust Planning converts strategy into an executable, resourced roadmap. The exam tests discovery, policy design, architecture decisions, pilot selection, phasing, and the NIST migration workflow. Planning is where you prove that a proposed change is feasible, funded, and measurable.

Core rules

  • Inventory before you protect: data, applications, identities, devices, services, and data flows. Classify data and map business processes to it.
  • Identify actors (users, service accounts, robots) and their current access paths, including shadow IT and legacy protocols.
  • Formulate policy before selecting products: who may access what, under which conditions, with what obligation (MFA, posture, time-bound).
  • Design the enforcement architecture: where PEPs sit, which PDP is authoritative, what logs feed the PE, and how sessions are revoked.
  • Follow NIST SP 800-207's migration logic: identify business processes and data flows, identify actors and assets, formulate policies, select candidate ZTA deployments, then deploy and monitor.
  • Phase the work. A common sequence is identity and MFA, device posture, application access (ZTNA/SDP), network microsegmentation, and data-centric controls.
  • Include budget, skills, dependencies, a risk register, and rollback criteria.

Worked example

A 1,200-person firm has SaaS applications, a legacy ERP, and remote staff. Phase 0 inventories identities and data flows and finds the ERP uses fixed passwords and flat network access. Phase 1 deploys SSO and MFA. Phase 2 adds device posture for finance and IT. Phase 3 pilots an SDP gateway for the ERP with ten users, logging every decision. Phase 4 expands microsegmentation. Success criteria: 100% of ERP access policy-mediated, zero direct network paths, and a tested revocation within five minutes. The reasoning: each phase reduces a named risk and produces evidence for the next funding cycle.

Traps that cost marks

  • Planning only for new cloud applications and ignoring legacy systems.
  • Choosing products before policy, which locks in vendor assumptions.
  • Skipping data classification, so least privilege has no object.
  • Treating the plan as a one-time document rather than a living roadmap.